GandCrab is the malware I Choose Awareness Training Identification: Explain the steps to identify an infection with your sample. Refer to your Behavioral Analysis results from before, and list the prominent pieces of suspicious activity. Quarantine: Based on your Behavioral Analysis results from before, explain the steps users should take to minimize damage to their computer and the rest of the network if they find their device to be infected. Escalation: Suggest a simple escalation protocol in the event an end user finds a compromised device. Who and which other teams should be notified? Identification TODO: Explain the steps to identify an infection with your sample. Refer to your Behavioral Analysis results from before, and list the prominent pieces of suspicious activity. For example, if your malware made a GET request to the server 182.98.28.9, you might tell your users to check their firewall logs for records of communications to that IP address. Be sure to explicitly refer to your behavioral analysis to justify your steps. Quarantine and Response TODO: Based on your Behavioral Analysis results from before, explain the steps users should take to minimize damage to their computer and the rest of the network if they find their device to be infected. For example, if your malware made a GET request to the server 182.98.28.9, you might tell your users to disconnect from the network, and recommend setting a firewall rule that blocks all traffic to/from that IP. If it downloaded a malicious file, you might recommend disconnecting from the network; backing up personal data to an external hard drive; and restoring the operating system. Be sure to explicitly refer to your behavioral analysis to justify your steps. Escalation TODO: Based on your Behavioral Analysis results from before, explain who should be notified in the event a device on an enterprise network is found to be infected with your malware. For example, if your malware is ransomware, you should notify your Security team, as well as your direct manager (who will likely escalate to the executive team). If your malware is a trojan, you should simply follow the steps in Quarantine and Response, and notify your security team about the incident. Be sure to explicitly refer to your behavioral analysis to justify your steps.